v0.2.5

What's Changed

• ci(release): don't block the GitHub Release on crate/image publishing by @mstykow in #1253
• fix(license): make match from_file the repo-relative scan path by @mstykow in #1254
• test(scanner): verify CRLF files report correct detection line spans by @mstykow in #1256
• feat(license): extend --fail-on gate to package/dependency declared licenses by @mstykow in #1255
• feat(serve): fetch repositories in-process with gix (no external git) by @mstykow in #1258
• docs: fix stale references found in a docs-wide audit by @mstykow in #1261
• docs(serve): align repository-ingest docs with in-process gix by @mstykow in #1260

Full Changelog: v0.2.4...v0.2.5

v0.2.4

What's Changed

• fix(release): ship static musl linux binaries with mimalloc by @mstykow in #1249
• fix(output): emit POSIX resource paths on Windows + add cross-platform smoke test by @mstykow in #1250
• docs: add GitHub Action usage to README by @mstykow in #1251
• feat(license): compliance severity, --fail-on gate, and SARIF output by @mstykow in #1252

Full Changelog: v0.2.3...v0.2.4

v0.2.3

What's Changed

• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #1236
• feat(vscode-extension): parse VSIX manifest metadata by @leemeo3 in #1237
• perf(license): re-land referenced-filename tokenization memoization + VSIX benchmark (#1238) by @mstykow in #1239
• fix(license): don't apply prose-context pruning to minified long lines by @mstykow in #1240
• ci: attest build provenance for release binaries by @mstykow in #1241
• feat(output): brand the HTML report with the Provenant mark by @mstykow in #1243
• feat(output): refine the HTML report mark to match the org logo by @mstykow in #1244
• perf(scanner): bound content-detection text to 10 MB (#1245) by @mstykow in #1247
• fix(deps): update rust crate bit-set to 0.11.0 by @renovate[bot] in #1246
• chore: move repository to the getprovenant organization by @mstykow in #1248

Full Changelog: v0.2.2...v0.2.3

v0.2.2

What's Changed

• feat(cli): show per-phase timing breakdown only under --verbose by @mstykow in #1225
• docs: add Provenant-vs-ScanCode race demo to README by @mstykow in #1224
• fix(cli): make license-index startup messaging honest and quiet by @mstykow in #1226
• perf(cli): speed up license-dataset export ~65x and add logging to all subcommands by @mstykow in #1227
• fix(deps): bump crossbeam-epoch to 0.9.20 for RUSTSEC-2026-0204 by @mstykow in #1229
• docs: re-record README demo and add reusable recording scripts by @mstykow in #1228
• perf(xtask): scope golden-tests feature to the two bins that need it by @mstykow in #1231
• fix(license): correct MPL and EPL version mislabels in detection rules by @mstykow in #1230
• fix(copyright): strip trailing "Website: " bleed from authors by @mstykow in #1232
• feat(ci): add weekly ScanCode -> Provenant issue triage by @mstykow in #1234

Full Changelog: v0.2.1...v0.2.2

v0.2.1

What's Changed

• chore(deps): update rust crate anyhow to v1.0.103 [security] by @renovate[bot] in #1193
• fix(post-processing): prefer LICENSE over NOTICE when co-hosted legal files disagree by @mstykow in #1194
• feat(parsers): normalize npm slash-separated dual-license declared strings by @mstykow in #1195
• fix(deps): remove direct ttf-parser dependency by @mstykow in #1201
• fix(deps): update rust crate os_info to 3.15.0 by @renovate[bot] in #1200
• fix(deps): update rust crate log to 0.4.33 by @renovate[bot] in #1199
• chore(deps): update rust workspace dependencies by @renovate[bot] in #1198
• chore(deps): update dependency prettier to v3.9.0 by @renovate[bot] in #1197
• chore(deps): update dependency lefthook to v2.1.9 by @renovate[bot] in #1196
• fix(copyright): compose obfuscated emails so multi-holder notices chain past them by @mstykow in #1203
• fix(post-processing): prefer LICENSE over NOTICE when co-hosted legal files disagree by @mstykow in #1202
• docs(benchmarks): record prometheus, redis, and bevy comparison runs by @mstykow in #1204
• fix(copyright): drop SSPL "copyright, or other" prose false positive by @mstykow in #1205
• fix(copyright): collapse padding inside angle-bracketed obfuscated emails by @mstykow in #1206
• docs(benchmarks): record kirigami, go-ethereum, and arrow comparison runs by @mstykow in #1207
• fix(deps): update rust crate pdf_oxide to 0.3.69 by @renovate[bot] in #1211
• chore(deps): ignore blocked quick-xml advisories, drop stale entry by @mstykow in #1212
• chore(deps): update dependency prettier to v3.9.4 by @renovate[bot] in #1210
• feat(assembly): attach Ivy properties dependencies by @leemeo3 in #1208
• fix(deps): update rust crate quick-xml to 0.41.0 [security] by @renovate[bot] in #1209
• chore(renovate): pin dependency versions to fix artifact update failures by @mstykow in #1214
• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #1216
• feat(output): render custom templates with MiniJinja and a ScanCode-compatible context by @mstykow in #1219
• chore(deps): update dependency rust to v1.96.0 by @renovate[bot] in #1215
• feat(assembly): attach Clojure deps.edn dependencies by @leemeo3 in #1218
• feat(clojure): resolve dynamic defproject identity, ~def deps, discards, and deps.edn classifiers by @mstykow in #1221
• fix(copyright): detect open-ended year ranges ending in "now" by @mstykow in #1222
• fix(license): canonicalize LicenseRef-scancode SPDX keys to mirror license keys by @mstykow in #1223

Full Changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• fix(assembly): emit one package per conda-meta installed record by @mstykow in #1156
• fix(font): decode name records individually to stop run-on URL false positives by @mstykow in #1158
• fix(assembly): split distinct-GAV Maven .pom siblings into separate packages by @mstykow in #1159
• fix(assembly): subsume Diffusers pipeline-component config.json into the pipeline package by @mstykow in #1157
• fix(copyright): drop false positives from subword-tokenizer data files by @mstykow in #1155
• refactor(assembly): make multi-package directory assembly registry-based by @mstykow in #1161
• refactor(assembly): register per-datasource merge-skip rules by @mstykow in #1162
• verify: meson, pipenv, rules_python, cli, CLIP benchmark targets + drive-by fixes by @mstykow in #1163
• fix(assembly): promote Meson project() manifests to top-level packages by @mstykow in #1164
• fix(assembly): promote vcpkg ports and manifests to top-level packages by @mstykow in #1165
• fix(assembly): promote Leiningen project.clj to top-level packages by @mstykow in #1166
• fix(assembly): promote Arch .SRCINFO/.PKGINFO packages to top-level packages by @mstykow in #1168
• fix(assembly): promote sbt build.sbt projects to top-level packages by @mstykow in #1167
• fix(assembly): keep distinct NuGet projects/nuspecs as separate packages by @mstykow in #1170
• fix(assembly): keep distinct BitBake recipes as separate packages by @mstykow in #1169
• fix(assembly): promote multi-package opam roots and name .opam files by filename by @mstykow in #1171
• refactor(assembly): require a justified reason for every UNASSEMBLED datasource by @mstykow in #1172
• fix(assembly): keep distinct wheels in a wheelhouse as separate packages by @mstykow in #1173
• fix(assembly): keep distinct Ruby gemspecs in one directory as separate packages by @mstykow in #1174
• feat(parsers): add static Elixir mix.exs project manifest parser by @mstykow in #1179
• fix(assembly): hoist purl-less records' dependencies and refresh affected benchmark rows by @mstykow in #1180
• feat(parsers): emit npm overrides and yarn resolutions as pinned deps by @mstykow in #1181
• feat(parsers): record PEP 621 license-file reference from pyproject by @mstykow in #1183
• fix(license): stop clue and low-coverage partial matches leaking into detected license expression by @mstykow in #1182
• feat(post-processing): adopt package declared license from co-hosted and origin-manifest license files by @mstykow in #1184
• fix(post-processing): promote co-hosted legal license in key form with SPDX field by @mstykow in #1187
• docs(benchmarks): record terraform, superset, and godot verification rows by @mstykow in #1188
• fix(parsers): resolve yarn.lock npm: alias keys to aliased package identity by @mstykow in #1189
• fix(post-processing): mirror reference-following SPDX fields on key structure by @mstykow in #1190
• docs(adr): reject file-level package_data license stamping (ADR 0010) by @mstykow in #1191
• fix(scanner): hold key form in FileInfo.detected_license_expression by @mstykow in #1192

Full Changelog: v0.1.15...v0.2.0

v0.1.15

What's Changed

• fix(license-index): build automata off the rayon pool to avoid scan deadlock by @mstykow in #1123
• feat(vcpkg): pin deps from overrides and parse standalone configuration by @mstykow in #1124
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 2) by @mstykow in #1125
• fix(parsers): recover SPDX core from R DESCRIPTION license idioms by @mstykow in #1126
• feat(parsers): map bare informal declared license names via a curated alias config by @mstykow in #1128
• fix(parsers): bail to honest null on unresolved R license alternatives by @mstykow in #1129
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 3) by @mstykow in #1130
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 4) by @mstykow in #1131
• docs(benchmarks): re-measure ten more M1 targets on M5 (batch 5) by @mstykow in #1132
• fix(license): stop pruning license refs on headers with a 'no' substring word by @mstykow in #1133
• docs(benchmarks): re-measure 19 more M1 targets on M5 (batch 6) by @mstykow in #1134
• fix(license-detection): compare referenced filenames on tokens, not raw substring by @mstykow in #1135
• fix(bazel): collapse internal BUILD targets to one component per build directory by @mstykow in #1136
• fix(assembly): propagate declared license across collapsed Bazel/Buck build targets by @mstykow in #1137
• docs(benchmarks): migrate artifact rows to M5 with a reproducible fetch manifest by @mstykow in #1138
• docs(benchmarks): migrate 9 medium + 3 large repo targets to M5 by @mstykow in #1139
• feat(vcpkg): parse classic CONTROL metadata by @leemeo3 in #1140
• fix(vcpkg): bound CONTROL feature dependency paragraphs by @mstykow in #1141
• docs(benchmarks): refresh large-repo rows on M5 + Starlark/OCI parser robustness fixes by @mstykow in #1143
• fix(android): handle text manifests, malformed APKs, and legacy METADATA gracefully by @mstykow in #1148
• fix(output): exclude benign binary-content skips from scan_errors by @mstykow in #1149
• feat(xtask): single-source the benchmark --processes worker count by @mstykow in #1147
• docs(benchmarks): refresh chromium row (0 scan errors after #1148/#1149) by @mstykow in #1150
• feat(ivy): parse dependencies.properties coordinates by @leemeo3 in #1142
• feat(gradle): normalize declared licenses via shared name/url resolver by @mstykow in #1151
• feat(helm): read declared license from artifacthub.io/license annotation by @mstykow in #1153
• feat(assembly): adopt co-hosted LICENSE as package declared license (ADR 0010) by @mstykow in #1152

Full Changelog: v0.1.14...v0.1.15

v0.1.14

What's Changed

• fix(copyright): suppress Creative Commons license-text false positives by @mstykow in #1102
• verify: refresh ten benchmark targets; fix Maven reactor collapse and author junk by @mstykow in #1101
• fix(copyright): stop binary files from emitting junk copyrights and holders by @mstykow in #1103
• docs(testdata): document fixture provenance and attribution policy by @mstykow in #1104
• verify: refresh ten benchmark targets on M5 Pro (sweep 8) by @mstykow in #1105
• feat(compare-outputs): add cross-file field-value frequency rollup by @mstykow in #1106
• fix(copyright): drop source-code FPs and bracketed email author contacts by @mstykow in #1107
• fix(cargo): stop workspace inheritance leaking literal "workspace" by @mstykow in #1108
• perf(license): bound sequence matching on oversized query runs by @mstykow in #1109
• fix(copyright): suppress copyright/holder/author false positives from license-text regions by @mstykow in #1110
• fix(compare): share field-value frequency rollup with compare subcommand by @mstykow in #1111
• docs(benchmarks): refresh uv, npm/cli, DefectDojo after license perf fix (#1109) by @mstykow in #1112
• docs(benchmarks): refresh DataScience and bazel outliers after license perf fix by @mstykow in #1113
• perf(license): window query-run matchables instead of scanning whole query by @mstykow in #1114
• perf(copyright): gate split-email normalization with a cheap adjacency prefilter by @mstykow in #1116
• docs(benchmarks): refresh rows understated by license/copyright perf fixes (#1114, #1116) by @mstykow in #1115
• docs(benchmarks): make non-repository benchmark targets user-reproducible by @mstykow in #1117
• docs(benchmarks): re-measure ten M1 targets on M5 for a hardware-consistent chart by @mstykow in #1118
• docs(benchmarks): re-measure artifact rows on M5 with reproducible pins by @mstykow in #1119
• feat(vcpkg): parse registry lock metadata by @leemeo3 in #1120
• fix(copyright): unwrap XML/C# copyright wrappers and detect HTML © entities by @mstykow in #1122

New Contributors

• @leemeo3 made their first contribution in #1120

Full Changelog: v0.1.13...v0.1.14

v0.1.13

What's Changed

• docs(benchmarks): refresh next 10 targets on M5 Pro 4-proc methodology by @mstykow in #1082
• chore(release): bundle LICENSE and NOTICE in binary release archives by @mstykow in #1084
• fix(assembly): enrich coordinate-less manifest declared license from its own file by @mstykow in #1083
• docs(benchmarks): refresh next 10 targets on M5 Pro 4-proc methodology by @mstykow in #1086
• fix(assembly): resolve parent-relative manifest license-file references by @mstykow in #1087
• fix(parsers): normalize Cargo legacy slash dual-license to SPDX OR by @mstykow in #1088
• chore: address greptile follow-ups on #1087 and #1088 by @mstykow in #1089
• docs(benchmarks): refresh next 10 targets on M5 Pro 4-proc methodology by @mstykow in #1092
• docs(benchmarks): round scancode.io speedup to 12.83x by @mstykow in #1093
• fix(parsers): extract CocoaPods license :type hash value for declared license by @mstykow in #1094
• fix(bazel): resolve BUILD target licenses attribute as file references by @mstykow in #1095
• fix(parsers): resolve Maven multi-license name declarations by @mstykow in #1097
• feat(release): generate and bundle a third-party license disclosure by @mstykow in #1098
• chore(attribution): retain ScanCode trademark notice in derived-file headers by @mstykow in #1099
• chore(attribution): fix derived-file classification and retain difflib/PSF origin by @mstykow in #1100

Full Changelog: v0.1.12...v0.1.13

v0.1.12

What's Changed

• enhancement(benchmark): record copyright/email/url/info scan phase timings by @mstykow in #1036
• fix(parsers): surface silent entry-drop truncation across all parsers by @mstykow in #1038
• fix(assembly): deterministic assembler order and scoped nested-merge dedup by @mstykow in #1037
• fix(copyright): skip overlong words instead of truncating the holder tail by @mstykow in #1039
• enhancement(encoding): surface near-binary text-skip diagnostic and pin encoding edge cases by @mstykow in #1040
• test(license): pin refinement threshold boundaries and document provenance by @mstykow in #1041
• perf(pipeline): skip unused per-file SHA-256 and fuse multi-hash under --info by @mstykow in #1042
• perf(copyright): single-pass copyright-symbol normalization in prepare_text_line by @mstykow in #1043
• perf(license): prune and defer set-intersection work in candidate selection by @mstykow in #1044
• perf(license): use FxHash for candidate-selection per-run set/map by @mstykow in #1048
• docs(cli): clarify --max-in-memory bounds the in-scan working set, not peak RSS by @mstykow in #1049
• docs(cli): simplify --max-in-memory section for a user audience by @mstykow in #1050
• fix(deps): update rust crate daachorse to 3.0.2 by @renovate[bot] in #1051
• perf(license): faster candidate selection via dense Vec maps + bitset high-gate by @mstykow in #1054
• fix(xtask): normalize random package UIDs in perf-ab --check-output by @mstykow in #1055
• perf(license): build the two index automata concurrently (~24% faster cold build) by @mstykow in #1056
• perf(build): thin LTO for profiling profile (~3.5x faster profiling builds) by @mstykow in #1060
• perf(license): cache per-file line index for matched-text extraction (3.7× faster on large-file repos) by @mstykow in #1059
• perf(license): FxHashMap + buffer reuse in sequence-matching hot loop by @mstykow in #1062
• perf(license): hoist candidate-independent work out of sequence-matching driver (~23% on uv) by @mstykow in #1063
• fix(composer): extract per-package declared license from composer.lock by @mstykow in #1064
• fix(cargo): resolve workspace-inherited license into declared expression by @mstykow in #1068
• docs(benchmarks): refresh 13 targets on M5 Pro and regenerate chart by @mstykow in #1069
• fix(assembly): don't attribute co-located LICENSE holder to resolved dependencies by @mstykow in #1070
• fix(buck): synthesize pkg:buck purl for BUCK and METADATA.bzl targets by @mstykow in #1067
• fix(deps): update rust crate chrono to 0.4.45 by @renovate[bot] in #1071
• docs(benchmarks): refresh 10 more targets on M5 Pro and regenerate chart by @mstykow in #1074
• fix(license): normalize ambiguous bare declared-license names by @mstykow in #1075
• fix(copyright): strip PE version-info field labels and separator runs by @mstykow in #1076
• fix(parsers): resolve declared license to canonical index key by @mstykow in #1078
• docs(benchmarks): refresh 10 targets on M5 Pro 4-proc methodology by @mstykow in #1079
• feat(output): emit file-level detected_license_expression in scancode keys by @mstykow in #1080
• fix(assembly): stop smearing a multi-package DB file's license onto its packages by @mstykow in #1081

Full Changelog: v0.1.11...v0.1.12